Palo Alto Networks AI identifies 14,000 new vulnerabilities

Palo Alto Networks has developed an autonomous artificial intelligence system called the Network and Open-Source Vulnerability Analyzer (NOVA) that has identified 14,090 previously unknown software vulnerabilities. During a two-month evaluation of 3,915 open-source software projects, the tool found that 99.4% of the flaws had not been publicly reported, with nearly 40% classified as high or critical severity.

NOVA utilizes a multi-agent AI architecture to manage the entire vulnerability research workflow. This includes reviewing software repositories, identifying and prioritizing risks, generating proof-of-concept exploits for validation, and preparing disclosure reports for software maintainers. The system is also capable of proposing defensive recommendations and potential patches.

The research highlights that 92% of the findings were logic and semantic flaws, such as code injection, access control issues, and server-side request forgery. Additionally, the study found that using multiple AI models in combination improves detection coverage, as different models tend to specialize in different aspects of code analysis.